MALICIOUS — virussign.com_0584634c57a6effd4b84619c3a3e7fa0.vir

MALICIOUS — virussign.com_0584634c57a6effd4b84619c3a3e7fa0.vir is a unknown sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (71/100), attributed to the Kepavll family. 4 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: d78f6921cee1d994b96fd92cfb95a406cbe61c48ef160d86264c0148bc2c9e60
• SHA-1: 8f28747501adb3c8bf43b351ee27386ff572a6fb
• MD5: 0584634c57a6effd4b84619c3a3e7fa0
• ssdeep: 24576:LxylgX+R74MxNAVJnaAF/z87DrrWx6V8r3//yToLv2LFr:1yzx4WiaGSHkS8r3yTwut
• TLSH: T1295533212A56D2B07E0C23F831EF0D9B147B1D16D369B880BD412EFE5C539B25B44BA9
• Submitted as: virussign.com_0584634c57a6effd4b84619c3a3e7fa0.vir
• File type: unknown · Size: 1226660 bytes
• Verdict: malicious (71/100) · Family: Kepavll

Source: VirusSign · first seen 2026-07-24T00:00:00.000Z · SHA-256 verified

Detections (4 of 51 engines)

• capa (capabilities): beacon to command-and-control
• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:Win32/Kepavll!rfn
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1071.001

Why this verdict

The malicious score of 71/100 is the fusion of 3 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Kepavll!rfn (rule Trojan:Win32/Kepavll!rfn) - engine signal, weight 0.55, confidence 0.85
• beacon to command-and-control (rule beacon to command-and-control) - capa signal, weight 0.45, confidence 0.80
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

This unknown is a container, so it was not detonated itself. Its extracted members were re-submitted and analyzed as their own samples, and the runtime behaviour lives on those reports.

More Kepavll samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report